CVE-2026-126297: Algorithmic Complexity Denial of Service in NLTK ConllCorpusReader

Vulnerability ID: CVE-2026-126297
CVSS Score: 7.5
Published: 2026-11-14

CVE-2026-126297 (GHSA-v8f3-6phw-6mh9) is an uncontrolled resource consumption and algorithmic complexity vulnerability in the Natural Language Toolkit (NLTK) prior to version 3.10.4. Located in the Semantic Role Labeling (SRL) parser within nltk/corpus/reader/conll.py, the flaw allows an attacker to trigger quadratic O(N^2) CPU processing overhead by providing crafted CoNLL-formatted corpus inputs containing decoy span columns or nested full-width verb spans. Applications parsing untrusted linguistic corpora can experience prolonged CPU exhaustion and application-level Denial of Service (DoS).

TL;DR

An algorithmic complexity flaw (CWE-407) in NLTK's ConllCorpusReader._get_srl_instances and ConllSRLInstance.__init__ causes quadratic O(N^2) runtime scaling when parsing crafted CoNLL Semantic Role Labeling data, leading to CPU Denial of Service in NLTK versions prior to 3.10.4.

⚠️ Exploit Status: POC

Technical Details

  • CVE / GHSA ID: CVE-2026-126297 / GHSA-v8f3-6phw-6mh9
  • Weakness Class: CWE-400 (Uncontrolled Resource Consumption) / CWE-407 (Inefficient Algorithmic Complexity)
  • Affected Component: ConllCorpusReader.get_srl_instances & ConllSRLInstance.init_ (nltk/corpus/reader/conll.py)
  • Attack Vector: Network / Crafted CoNLL SRL Corpus Input
  • CVSS Score: 7.5 High (CVSS v3.1) / 8.7 High (CVSS v4.0)
  • EPSS Score: 0.582% (48.33rd percentile)
  • Exploit Status: Proof of Concept (Regression Test Suite)
  • CISA KEV Status: Not Listed

Affected Systems

  • Natural Language Toolkit (NLTK) Python Library
  • nltk: < 3.10.4 (Fixed in: 3.10.4)

Code Analysis

Commit: 9cacbb9

Pre-index wordnum_to_spanlist in ConllCorpusReader._get_srl_instances to avoid per-predicate rescanning.

Commit: 7bae75f

Replace range(start, end) verb span expansion with 1D sweep-line prefix sum in get_srl_instances and ConllSRLInstance.init_.

Exploit Details

  • GitHub Security Advisory: Advisory and regression test cases demonstrating quadratic O(N^2) runtime scaling via crafted CoNLL SRL grids.

Mitigation Strategies

  • Upgrade NLTK to version 3.10.4 or later to replace quadratic rescanning and range expansion with linear 1D sweep-line indexing.
  • Pre-validate untrusted CoNLL files to enforce strict caps on tokens per sentence, columns per row, and bracket nesting depth per cell.
  • Isolate corpus parsing tasks in separate worker processes with strict execution timeouts and OS-level CPU and memory limits.

Remediation Steps:

  1. Audit Python environments and dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) for nltk versions prior to 3.10.4.
  2. Upgrade nltk using pip: pip install --upgrade "nltk>=3.10.4".
  3. Verify the installed version via python -c "import nltk; print(nltk.__version__)" to confirm it is 3.10.4 or higher.
  4. Redeploy affected NLP pipelines or web services that ingest CoNLL-formatted datasets.

References

Read the full report for CVE-2026-126297 on our website for more details including interactive diagrams and full exploit analysis.